leftblock 0.3.2__tar.gz → 0.3.3__tar.gz

{leftblock-0.3.2 → leftblock-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: leftblock
-Version: 0.3.2
+Version: 0.3.3
 Summary: LeftBlock: a pluggable inspection gate for Git commits
 License: MIT License
         
@@ -69,7 +69,7 @@ LeftBlock has been donated to **Data Parade (`DataParade-io`)**, alongside
 BotSpy. Its repository is
 [DataParade-io/LeftBlock](https://github.com/DataParade-io/LeftBlock).
 
-**LeftBlock 0.3.2 is unreleased.** The current source uses `leftblock` as its
+LeftBlock is published on PyPI as `leftblock`. The current source uses `leftblock` as its
 distribution, Python package, and CLI name. It includes no earlier package
 aliases or command shims. The CLI is also available as
 `python -m leftblock.cli`.
@@ -121,26 +121,15 @@ configures the integration; it does not install scanner binaries.
 
 **1. Install the CLI:**
 
-While 0.3.2 is unreleased, install only a reviewed local checkout containing
-these changes. From that checkout, in the intended Python environment:
+In the intended Python environment:
 
 ```bash
-python -m pip install .
+python -m pip install leftblock==0.3.3
 python -m leftblock.cli --help
 ```
 
-The installation is from local source, not a published release. Confirm the
-checkout's commit and validation results before installing; do not assume
-`main` or an earlier feature-branch commit contains this implementation.
 Follow the migration checklist above before replacing an earlier setup.
 
-After the release is published and its distribution identity is verified,
-the versioned package installation will be:
-
-```bash
-python -m pip install leftblock==0.3.2
-```
-
 **2. Enable local staged protection:**
 
 ```bash

{leftblock-0.3.2 → leftblock-0.3.3}/README.md

@@ -36,7 +36,7 @@ LeftBlock has been donated to **Data Parade (`DataParade-io`)**, alongside
 BotSpy. Its repository is
 [DataParade-io/LeftBlock](https://github.com/DataParade-io/LeftBlock).
 
-**LeftBlock 0.3.2 is unreleased.** The current source uses `leftblock` as its
+LeftBlock is published on PyPI as `leftblock`. The current source uses `leftblock` as its
 distribution, Python package, and CLI name. It includes no earlier package
 aliases or command shims. The CLI is also available as
 `python -m leftblock.cli`.
@@ -88,26 +88,15 @@ configures the integration; it does not install scanner binaries.
 
 **1. Install the CLI:**
 
-While 0.3.2 is unreleased, install only a reviewed local checkout containing
-these changes. From that checkout, in the intended Python environment:
+In the intended Python environment:
 
 ```bash
-python -m pip install .
+python -m pip install leftblock==0.3.3
 python -m leftblock.cli --help
 ```
 
-The installation is from local source, not a published release. Confirm the
-checkout's commit and validation results before installing; do not assume
-`main` or an earlier feature-branch commit contains this implementation.
 Follow the migration checklist above before replacing an earlier setup.
 
-After the release is published and its distribution identity is verified,
-the versioned package installation will be:
-
-```bash
-python -m pip install leftblock==0.3.2
-```
-
 **2. Enable local staged protection:**
 
 ```bash

{leftblock-0.3.2 → leftblock-0.3.3}/leftblock/data/gitleaks.toml

@@ -165,6 +165,20 @@ regexes = [
   '''^\n?    "(?:[A-Za-z][A-Za-z0-9_]*-)+[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json"[ \t]*:[ \t]*-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?,?[ \t]*\r?$''',
 ]
 
+# Kanbus 0.40+ records a public per-project UUID v4 in .kanbus.yml so every
+# clone shares one realtime topic. Accept only the top-level YAML key with a
+# version-4 UUID; indented keys, other keys and other files stay detected.
+[[rules.allowlists]]
+description = "Kanbus project_id in .kanbus.yml"
+condition = "AND"
+paths = [
+  '''(^|/)\.kanbus\.yml$''',
+]
+regexTarget = "line"
+regexes = [
+  '''^\n?project_id:[ \t]*[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}[ \t]*\r?$''',
+]
+
 [[rules]]
 id = "leftblock-actor-id"
 description = "actor/user/author ID value"

{leftblock-0.3.2 → leftblock-0.3.3}/leftblock.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: leftblock
-Version: 0.3.2
+Version: 0.3.3
 Summary: LeftBlock: a pluggable inspection gate for Git commits
 License: MIT License
         
@@ -69,7 +69,7 @@ LeftBlock has been donated to **Data Parade (`DataParade-io`)**, alongside
 BotSpy. Its repository is
 [DataParade-io/LeftBlock](https://github.com/DataParade-io/LeftBlock).
 
-**LeftBlock 0.3.2 is unreleased.** The current source uses `leftblock` as its
+LeftBlock is published on PyPI as `leftblock`. The current source uses `leftblock` as its
 distribution, Python package, and CLI name. It includes no earlier package
 aliases or command shims. The CLI is also available as
 `python -m leftblock.cli`.
@@ -121,26 +121,15 @@ configures the integration; it does not install scanner binaries.
 
 **1. Install the CLI:**
 
-While 0.3.2 is unreleased, install only a reviewed local checkout containing
-these changes. From that checkout, in the intended Python environment:
+In the intended Python environment:
 
 ```bash
-python -m pip install .
+python -m pip install leftblock==0.3.3
 python -m leftblock.cli --help
 ```
 
-The installation is from local source, not a published release. Confirm the
-checkout's commit and validation results before installing; do not assume
-`main` or an earlier feature-branch commit contains this implementation.
 Follow the migration checklist above before replacing an earlier setup.
 
-After the release is published and its distribution identity is verified,
-the versioned package installation will be:
-
-```bash
-python -m pip install leftblock==0.3.2
-```
-
 **2. Enable local staged protection:**
 
 ```bash

{leftblock-0.3.2 → leftblock-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "leftblock"
-version = "0.3.2"
+version = "0.3.3"
 description = "LeftBlock: a pluggable inspection gate for Git commits"
 readme = "README.md"
 license = {file = "LICENSE"}

{leftblock-0.3.2 → leftblock-0.3.3}/tests/test_branding.py

@@ -196,7 +196,7 @@ class DistributionOwnershipTests(unittest.TestCase):
 
     def test_distribution_owns_only_leftblock_command(self):
         self.assertIn("\nName: leftblock\n", "\n" + self.metadata)
-        self.assertIn("\nVersion: 0.3.2\n", "\n" + self.metadata)
+        self.assertIn("\nVersion: 0.3.3\n", "\n" + self.metadata)
         self.assertIn("\nLicense-File: LICENSE\n", "\n" + self.metadata)
         self.assertEqual(dict(self.entry_points["console_scripts"]), {"leftblock": "leftblock.cli:main"})
 
@@ -208,7 +208,7 @@ class DistributionOwnershipTests(unittest.TestCase):
             self.assertIn(name, self.names)
         self.assertEqual(
             {name.split("/")[0] for name in self.names},
-            {"leftblock", "leftblock-0.3.2.dist-info"},
+            {"leftblock", "leftblock-0.3.3.dist-info"},
         )
         self.assertEqual(self.rules, (PROJECT_ROOT / "leftblock/data/gitleaks.toml").read_bytes())
         self.assertEqual(self.license, (PROJECT_ROOT / "LICENSE").read_bytes())

{leftblock-0.3.2 → leftblock-0.3.3}/tests/test_false_positives.py

@@ -81,6 +81,48 @@ class KanbusIdTests(unittest.TestCase):
         }))
 
 
+def _uuid4(rng):
+    return "%s-%s-4%s-%s%s-%s" % (
+        rand_hex(rng, 8), rand_hex(rng, 4), rand_hex(rng, 3),
+        rng.choice("89ab"), rand_hex(rng, 3), rand_hex(rng, 12))
+
+
+@unittest.skipIf(GITLEAKS is None, "gitleaks binary not installed")
+class KanbusProjectIdTests(unittest.TestCase):
+    def _yml(self, body):
+        return scan_and_rule_ids({".kanbus.yml": body})
+
+    def test_top_level_project_id_passes(self):
+        rng = _rng()
+        self.assertEqual(self._yml(
+            "project_key: kbs\nproject_id: %s\n" % _uuid4(rng)), [])
+        self.assertEqual(scan_and_rule_ids({
+            "sub/.kanbus.yml": "project_id: %s  \n" % _uuid4(rng)}), [])
+
+    def test_indented_project_id_is_flagged(self):
+        self.assertEqual(self._yml(
+            "realtime:\n  project_id: %s\n" % _uuid4(_rng())),
+            ["leftblock-session-uuid"])
+
+    def test_other_key_in_kanbus_yml_is_flagged(self):
+        self.assertEqual(self._yml("session_id: %s\n" % _uuid4(_rng())),
+                         ["leftblock-session-uuid"])
+
+    def test_project_id_outside_kanbus_yml_is_flagged(self):
+        self.assertEqual(scan_and_rule_ids({
+            "config.yml": "project_id: %s\n" % _uuid4(_rng())}),
+            ["leftblock-session-uuid"])
+
+    def test_non_v4_uuid_is_flagged(self):
+        # Version nibble 1, not 4: only UUID v4 project ids are exempt.
+        rng = _rng()
+        v1 = "%s-%s-1%s-a%s-%s" % (rand_hex(rng, 8), rand_hex(rng, 4),
+                                   rand_hex(rng, 3), rand_hex(rng, 3),
+                                   rand_hex(rng, 12))
+        self.assertEqual(self._yml("project_id: %s\n" % v1),
+                         ["leftblock-session-uuid"])
+
+
 @unittest.skipIf(GITLEAKS is None, "gitleaks binary not installed")
 class MergeScopeTests(unittest.TestCase):
     def setUp(self):